1. Who we are and what this policy covers
This policy explains how Bastah collects, uses and protects personal data in the Bastah mobile app and on the website bastah.me, including shared store pages.
- Data controller: [Legal entity name], Amman, Jordan.
- Privacy contact: [email protected].
This policy is based on the Jordanian Personal Data Protection Law No. (24) of 2023, and on the requirements of the Apple App Store and Google Play. If there are extra rules for a specific country, you’ll find them under “Country annexes” at the end of this page.
In short: Bastah is an intermediary that brings stores (online stores and home businesses) together in one place. There are no payments in the app, so we don’t collect any card or bank account details. We don’t sell your data to anyone, and we don’t use it for targeted advertising.
2. The data we collect
2.1 Data you give us
| Category | What we collect |
|---|---|
| Account | Your email. We use it to sign you in with a 6-digit code. There are no passwords |
| Profile | Your name and city (required), phone number (optional) and profile photo (optional) |
| Addresses | The address type and name, city, area, street, building, floor, notes, and the map coordinates if you choose to set them |
| Chats | Text messages, photos, the locations and addresses you send, product cards and order cards |
| Orders | Products, options and quantities, the estimated price, your note, and the address or location you sent with the order |
| Reviews | The star rating, the text, up to 3 photos, and the seller’s reply |
| Reports and support | The report reason and your note, “Bastah Support” chat messages and photos, your support satisfaction rating, and your votes on FAQ answers |
| Preferences | Favorite stores and products, notification settings, the app language (Arabic or English), muted chats and blocked users |
2.2 Extra data if you open a store (sellers)
- Store data: name, handle (e.g. @yourname), category, type (online store or home business), description, logo, cover, city and area, opening hours, delivery details and minimum order, and your WhatsApp number and social media links if you add them.
- Products: names, prices, photos, sections, category fields (such as sizes or prep time) and availability.
- Review data: the store’s status, requests to change its identity, and reasons for refusal or suspension, if any.
Important: once a store is approved, its data and products become public. Everyone can see them in the app and on the store’s page on the website, including the WhatsApp number and social links if you added them. Don’t put personal information in your store that you don’t want published.
2.3 Data collected automatically
- Technical and security logs with our hosting providers: IP address, device or browser type, and the times of sign-ins and server requests. We use them for security, preventing abuse and fixing problems.
- Data on your device: a session token (so you stay signed in), your cart, and a temporary copy of some pages so they load quickly. It stays on your device and is cleared when you sign out or delete the app.
- Notification token: when you turn on push notifications, we store a token for your device so we can send them.
- App version: so we know whether the app needs an update.
2.4 Location, camera and photos
- Location: we never track your location, including in the background. We use location only when you choose to send your location in a chat or set your address on the map.
- Camera and photos: only when you pick or take a photo yourself, for your profile, your store, a product, a chat or a review. We don’t access the rest of your photos.
- You can withdraw these permissions anytime in your phone’s settings.
2.5 What we don’t collect
- Card, bank account or any other payment details.
- Passwords.
- The contacts on your phone.
- Advertising identifiers, or tracking across other apps and websites.
2.6 The website bastah.me
- The website uses no cookies, neither advertising nor analytics cookies.
- We use Cloudflare Web Analytics to count visits and see the most-read pages in aggregate. It uses no cookies, stores nothing on your device, doesn’t identify you personally and doesn’t track you across sites.
- A shared store page (bastah.me/@…) shows only the public data of an approved, visible store.
3. Why we use your data, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Creating your account and signing you in | Email, session token | Providing the service you asked for |
| Showing your profile and providing the service (browsing, cart, chats, orders, reviews, favorites) | Profile, addresses, chats, orders, reviews | Providing the service, and your consent |
| Sending your location or photos | The location and photos you choose | Your consent (phone permission and your choice) |
| Showing your store to people after review | Store and product data | Providing the service, and your consent |
| Reviewing stores, handling reports, preventing fraud and abuse | Store data, reports, only the reported chat, technical logs | Protecting users and the service, and legal obligations |
| Answering support requests | The support chat and your basic account data | Providing the service, and your consent |
| Notifications (messages, orders, reviews, store status) | Notification token, your settings | Your consent, which you can change in settings |
| Improving the service | Aggregate statistics that don’t identify you | Legitimate interest in improving the service |
| Complying with the law and official requests | Only what the law requires | Legal obligation |
When you create your account, Bastah asks for your explicit consent to the Terms of Use and this policy, and we store the time of your consent and the version you accepted. You can withdraw your consent anytime (see section 8), without affecting anything processed before you withdrew it.
4. Who sees your data inside Bastah
- Everyone: your name, photo and city as shown on your profile, your reviews with your name and photo, and the data of approved stores and their products.
- Only the other person in a chat: your messages and their photos, the address or location you send, and the order card.
- Your phone number is never shown to sellers or anyone else. Only you and a limited number of authorized Bastah team members can see it. If you want a seller to have it, send it to them yourself in the chat.
- The Bastah team: sees only what’s needed for store review, moderation and support, according to each staff member’s permissions. Email addresses and phone numbers are partly masked for most staff, and only a limited number of administrators can see them in full. Every staff member signs in with two-step verification.
5. Chat privacy
- The Bastah team doesn’t read your chats with sellers or customers.
- The only exception is when a report is filed about a specific chat. Then, only an authorized staff member can open that chat to check the report, after writing a mandatory reason.
- Every time a chat is opened, it’s logged in a record that can’t be edited or deleted: who opened it, when and why.
- Even then, the staff member doesn’t see the chat’s photos, only that a photo was sent.
- The “Bastah Support” chat is different: it’s a chat between you and the Bastah team, and the support team reads it to reply to you. Team replies appear under the name “Bastah team”.
- Chat photos are stored in a private storage area and can only be opened through temporary links by the two people in the chat.
- The “typing…” indicator is never stored.
6. Who we share data with (data processors)
We don’t sell or rent your data to anyone. We use service providers that process data on our behalf only, and only to provide the service:
| Provider | What it does | Data | Where it’s processed |
|---|---|---|---|
| Supabase | Database, sign-in, photo storage and real-time chat | All the service data described above | Frankfurt, Germany (European Union) |
| Resend | Sending emails (sign-in codes and email-change confirmations) | Your email address and the message content | United States |
| Cloudflare | Hosting the website and the admin panel, protection against attacks, and cookie-free visit statistics | IP address and technical request data | Global network |
| Expo (EAS) | Delivering app updates, and later sending push notifications | Technical device and app data, notification token | United States |
| Apple and Google | App stores, notification services (APNs and FCM), and maps in the app (Apple Maps on iPhone and Google Maps on Android) | Technical data, and the area you view on the map | According to each one’s policies |
Future services: when we add sign-in with Apple or Google, Bastah will receive from them only the email and name you agree to share. We’ll update this policy before turning on any new service that processes your data.
We may also disclose data:
- To the competent official authorities in Jordan when the law or a court order requires it, or to protect someone’s safety from serious danger.
- If Bastah merges, is sold, or transfers its business to another party, provided that party protects your data at a level no lower than this policy. We’ll let you know in advance.
7. Transferring data outside Jordan
The core service data is stored in the European Union (Germany), which applies a high level of data protection (the GDPR). Some processing happens in other countries, as shown in the table above.
To protect your data when it’s transferred:
- We choose providers that are contractually bound to protect the data and use it only to provide the service.
- All connections are encrypted (TLS), and stored data is encrypted by the hosting provider.
- We follow the conditions the Jordanian Personal Data Protection Law sets for transfers outside the Kingdom, and your consent to this policy covers these transfers.
8. How long we keep data
| Data | How long |
|---|---|
| Account, profile, addresses, favorites and settings | As long as your account exists. Deleted when the account is deleted |
| Stores and products | As long as they exist. When they or the account are deleted, they disappear for everyone right away, and a copy that only the moderation team can see is kept for 3 years for disputes and moderation, then deleted |
| Messages and reviews after you delete your account | They stay with the other person under “Deleted user” with no data that identifies you, because they’re part of their chat and of the store’s record. You can delete your reviews yourself before deleting your account |
| Reports and support chats | 3 years after they’re closed |
| The Bastah team’s decision log (who did what, when and why) | 5 years |
| The record of your consent to the terms and policy (version and time) | Kept for 5 years after the account is deleted as proof of consent, linked to a deleted account with no name or email |
| Sign-in and technical logs | A limited time with the hosting provider for security, then deleted automatically |
| Backups | Replaced automatically within a short time |
| Data on your device | Until you sign out or delete the app |
A request to delete your account by email is completed within 14 days of verifying that the account is yours. We may keep certain data longer if the law requires it or to preserve an existing legal right, and only as much as needed.
9. Your rights and how to use them
Under the Jordanian Personal Data Protection Law, you have the right to:
- Access: know whether we process your data, and get a copy of it.
- Correction: correct or update your data. You can edit your profile, addresses and store directly in the app.
- Deletion: delete your account and your data. In the app: “Account” → “Personal info” → “Delete account permanently”, or through the Delete account page.
- Objection and restriction: object to a specific processing or ask for it to be restricted.
- Withdrawing consent: withdraw your consent anytime, for example by turning off notifications, or location and photo permissions in your phone’s settings. Withdrawing consent to the core processing means the account can’t continue, so it’s deleted.
- Complaint: file a complaint with the Personal Data Protection Council in Jordan if you believe your rights weren’t respected. We hope you’ll contact us first so we can sort it out.
To use any of these rights: write to us at [email protected] from the email on your account, or through “Bastah Support” in the app. We may ask for proof that the account is yours before acting on the request, and we’ll reply within 30 days. We don’t charge any fee for these requests.
10. Data security
- Encryption: all connections between the app and the servers are encrypted.
- Isolation: security rules at the database level stop any user from reading or changing someone else’s data, even if they try to bypass the app.
- Limited access for the Bastah team: each staff member has a role and permissions limited to their work, sign-in requires two-step verification, and important decisions require a reason and are logged in a record that can’t be edited.
- Private photos: chat and support photos are in private storage, behind temporary links.
- Protected keys: the app and the website carry no secret server key.
- Review and testing: we run automated security tests on the access rules with every change.
No system is 100% secure. If your data is affected by a breach that is likely to affect your rights, we’ll notify the competent official authority and you within the time the law sets, explaining what happened, what we did and what you can do.
Found a security vulnerability? Write to us at [email protected] with the subject “Security vulnerability” and enough detail to reproduce it. Please don’t access other people’s data or disclose the vulnerability before it’s fixed, and we’ll get back to you quickly.
11. Minors
Bastah is intended for people 18 or older. We don’t knowingly collect data from anyone younger. If we learn that an account belongs to a minor, we’ll delete it. If you’re a parent or guardian and believe your child created an account, write to us at [email protected].
12. Messages we send you
- Email: we only send sign-in codes and email-change confirmations. We won’t send marketing emails without your separate consent.
- Notifications: according to what you choose in “Notification settings”. Store status and account status notifications always arrive, because they’re essential to the service.
13. Changes to this policy
We may update this policy when the service or the law changes. The last-updated date and the version number appear at the bottom of the page. For any material change, we’ll let you know in the app and ask you to accept the new version before you continue using it.
14. Contact
- Email: [email protected]
- In the app: “Account” → “Help and support” → “Message the Bastah team”
- Data controller: [Legal entity name], Amman, Jordan